a16z Podcast: What to Know about FedRAMP

with @ldhawke and @stevesi The government wants to get onto the cloud! But how do they assess the levels of risk in adopting specific cloud products, and which "cloud service providers" (aka "CSPs") to work with? That's where FedRAMP -- the Federal...

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Sonal?

  Hi, everyone. Welcome to the A6 and Z Podcast. I'm Sonal and today's episode is all about a compliance topic, FedRAMP, which is going to affect a lot of enterprise SaaS companies selling to government and actually even if not. So we share everything that startups need to know in this episode. Please note, you can find all the pointers, templates, and other links they mention in the show notes at a6andz.com/fedramp. I highly recommend you check that out, too, to get all the resources after listening to this episode. Okay, so now on to the intros. This episode is hosted by A6 and Z board partner, Stephen Sanofsky, who interviews Lisa Hock, VP of Security and Compliance at A6 and Z company Everlaw. By the way, you can also catch both Lisa and Stephen on another interesting

• 0:42Sonal?

  compliance topic that applies to many tech startups as well, GDPR, which we covered last year by going to a6andz.com/gdpr. But this episode is all about FedRAMP, which stands for the Federal Risk and Authorization Management Program. And here's what they cover: what risk means in selling to the government depending on your product features, some of the most commonly used acronyms to be aware of, which they quickly lightning round in between, how similar or different FedRAMP is to other types of certification, authorization, and compliance, such as ISO, SOC 2, GDPR, even HIPAA. Most importantly, they break down the steps to FedRAMP certification, including how and when to engage third-party

• 1:23Sonal?

  auditors and advisors, how long it takes, and how it affects sales. They also share the best strategy for moving forward with a customer lined up first, but they begin by discussing why startups should consider FedRAMP in the first place.

• 1:37Steven Sinofsky?

  Before everybody gets cynical about acronyms with the word Fed in them, and security, and the government, and all this other stuff, this is some pretty interesting things that you can do for your company, and it opens up a world of opportunity in terms of selling to the United States government and beyond, as we'll talk about. So first, welcome, Lisa.

• 1:58Speaker 02

  Thanks, Stephen.

• 1:59Steven Sinofsky?

  So if you're the CEO of a company, what are the core benefits of pursuing a FedRAMP authorization?

• 2:06Speaker 02

  So if you're the CEO of a cloud company and you want to sell your product to federal agencies, FedRAMP is probably going to be the only way in. There are some exceptions, very limited. For instance, if you want to do a private deployment in a facility for a single agency, but that's not what we're talking about today. We're talking about having a FedRAMP authorization, which, for the record, we are in process at Everlaw. We don't have our authorization yet. But it does open up a whole new market for you, for all of the federal agencies. And as well, it provides some credibility, too, to the general market from a security standpoint, outside of government.

• 2:41Steven Sinofsky?

  Yeah, that's something that we hear all the time, is that even if you want to sell to a company, a private or public company that isn't the government, they might look to see like, hey, did you get FedRAMP certified? So we know now that FedRAMP is a requirement to sell to the government. In most markets, especially in the US, the government is potentially a very big or the biggest potential customer for enterprise SaaS. No matter which agency you want to sell to, from DoD to ag or HHS or whatever, FedRAMP is going to be required. And in many cases, these connected or affiliated state organizations as well. Something we learned in Everlaw is that if you want to sell to a state attorney general, they're going to want FedRAMP authorization as well, just because chances are they're going to be involved in litigation with the federal agencies.

• 3:26Steven Sinofsky?

  So what is it that FedRAMP actually, quote, "tests" for in its process?

• 3:31Speaker 02

  So FedRAMP stands for the Federal Risk and Authorization Management Program. So FedRAMP, like the acronym says, it's all about risk. It's really a program that's designed to provide federal agencies with the information they need to make their own informed, risk-based decision about whether to adopt cloud and a specific product. I think there was a general recognition that in order for federal agencies to adopt cloud, they had to put in place a way for companies to meet the federal standards and allow the federal agencies to do these risk assessments.

• 4:09Steven Sinofsky?

  Risk is a very amorphous concept. How do they actually evaluate what risk?

• 4:13Speaker 02

  Well, for the security folks listening, hopefully, this will be comforting in the sense that they didn't make up something new. They used the CIA framework.

• 4:23Steven Sinofsky?

  Not the CIA.

• 4:24Speaker 02

  Which is not the agency. No, confidentiality, integrity, and availability. So for companies that have been through, say, SOC 2 or maybe ISO, they'll have heard these terms. And in addition, they also look at baseline or impact levels, high, moderate, or low.

• 4:42Steven Sinofsky?

  The high, moderate, or low are actually pretty important because that puts people into buckets of sort of users of the product.

• 4:49Speaker 02

  Yeah, exactly. So when you're going through a FedRAMP authorization, you're going to have to look at your product and figure out, okay, based on the impact and the information that is going to be in that cloud product, what level are you? High, so think law enforcement for high, think DoD, federal criminal information, or are you moderate?

• 5:12Steven Sinofsky?

  Like, normal, the agriculture department, or something like that, where it's sort of routine work.

• 5:16Speaker 02

  Yeah, exactly. And then for low, or there's even another...

• 5:22Steven Sinofsky?

  Like a low or low?

• 5:23Speaker 02

  A low or low, yeah. It's called low-impact SaaS.

• 5:25Steven Sinofsky?

  Ooh, that's a mean name. We don't mean it to that your product is low-impact.

• 5:29Speaker 02

  No, but they did create the low-impact SaaS for products that only contain enough personal information to essentially set up an account. So they need your name, they need your email, there's going to be a password, but you're not holding really confidential or sensitive agency information. So based on those impact levels, that is going to determine which baseline, and the baseline is a set of controls. And they have, on the high end, the most controls, on the moderate, you know, around 300.

• 5:58Steven Sinofsky?

  The four levels of impact levels, it's super interesting. There's only seven authorizations for like, high-security stuff, and they're all mostly, they're just the cloud infrastructure providers. In fact, like, of the seven highs, I actually went and looked it up, it was interesting, three of them are Microsoft, just for different parts of Microsoft, and then Oracle, and some specialized ones, and AWS. So, like, nobody has to worry about this extreme bar if you're mostly an app. They'll guide you to moderate or low.

• 6:26Speaker 02

  One cool thing about the FedRAMP.gov website is they have a marketplace for the folks out there kind of wondering, all right, what companies are doing the high, who's doing low, who's doing moderate? You can sort by that. And it's kind of interesting because, like you pointed out, the great majority are in the moderate category. And then there's a handful of highs and a handful of lows.

• 6:45Steven Sinofsky?

  So, given that they're not there to really bug Silicon Valley companies and make it hard for the government to become a cloud fighter, it's the opposite, the directive. Was specifically, we want to get the government on cloud. Like, it's too expensive to be on-prem, it's less secure, it's harder to do, it's less agile. So we want to get the government on cloud. If you're a government agency, what are some of the things that you observe right away when you see a FedRAMP authorized product sort of show up? Like, what is different about it?

• 7:13Speaker 02

  Well, I think if you've gone through FedRAMP, you're going to show up looking a lot more organized. You're going to have that governance infrastructure in place because FedRAMP is a mix of very technical things, but also governance-related things. So if you've set up your security program in a way that addresses things like personnel security, policies and procedures for specific things like role-based access control, then you're going to show up as looking like you really have your act together compared to a company that has these various security controls in place, but maybe hasn't gelled them into a program. I should have mentioned this earlier. So all of these sets of controls for the high, moderate, and low baseline are separated into control families.

• 7:58Speaker 02

  So for example, incident response is a family. But the more technical ones are things like configuration management, which deals with creating blueprints for the server types to meet functionality and hardening requirements, things that require implementing Center for Internet Security benchmarks. And we'll provide a link to the CIS benchmarks as well.

• 8:18Steven Sinofsky?

  Obviously, one of the things that ends up mattering the most to security is just sort of access and identity and the role of authorization in general. Where does that fit in in these families?

• 8:28Speaker 02

  So it spans several of them, but there is one control family called IA, which means identification and authorization, which deals with how you implement your system accounts, including credential management, version control, multi-factor authentication, which has to meet certain cryptographic standards. And it's worth noting that in these control families, sometimes...

• 8:51Speaker 02

  You, as a cloud service provider, are going to have the responsibility for the implementation, like something for authentication, but also sometimes the federal agency also has a responsibility in terms of how they implement their users and distribute out their usernames and so forth. So that is also something that's noted in the control family.

• 9:12Steven Sinofsky?

  So if you don't go through this authorization process and it's a recipe, there's like lots of decisions to make, lots of product design questions that are favorable to enterprise SaaS and have to sort of allow room to adapt to the variations across the government.

• 9:26Speaker 02

  And most of the controls, a company can implement them in their commercial environment as well. We want all of our commercial customers to benefit from the same level of security as our future federal customers.

• 9:39Steven Sinofsky?

  Because chances are, whether you try to sell to a big tech company or a non-tech company, that they've probably developed some list of things that look like these families, but might not be exactly the same. And ultimately, you're going to end up in the same boat trying to get all these done.

• 9:54Speaker 02

  I mean, the federal government and federal agencies are not the only ones that use the NIST framework for security and privacy. Many companies do it. A lot of security questionnaires are going to be based around NIST. So it's one of many acronyms I think we're going to go over today, right?

• 10:08Steven Sinofsky?

  Yeah. So I'm just going to go through a few of them and like make sure people know, because we'll say them and then we'll forget to expand them. And so NIST is one of my favorites because that goes so far back. That feels like 1950s NASA. And they're like in charge of weights and measures and stuff like that. But what do they do with this?

• 10:24Speaker 02

  NIST does a lot of cool stuff, but as it relates to what we're talking about today, NIST, the National Institute of Standards and Technology, is the agency that defines government-wide standards for technology and security. And the one specific NIST document that we're talking about today is a special publication 853, which deals with security and privacy controls for federal information systems.

• 10:48Steven Sinofsky?

  So FISMA?

• 10:49Speaker 02

  Yeah. So FISMA stands for Federal Information Security Management Act. And this is something that applies to federal government agencies and requires them to put in place a security framework to secure their information. So it doesn't apply to the private sector.

• 11:04Steven Sinofsky?

  So next was obviously a big government agency called OMB?

• 11:07Speaker 02

  Yeah. OMB is sort of like the COO for the federal government. They oversee budgeting and spending. And then their sibling agency, GSA, is a General Services Administration. And the FedRAMP office, so our friends in the FedRAMP PMO, which means Project Management Office, they sit under GSA.

• 11:27Steven Sinofsky?

  Awesome. And then finally, this whole thing is about the acronym they invented called CSPs.

• 11:33Speaker 02

  Yeah, CSP stands for Cloud Service Provider. And you'll also hear CSO, which stands for Cloud Service Offering. So FedRAMP is all about cloud, which is why I think we're here today talking about it for the SaaS folks out there.

• 11:46Steven Sinofsky?

  Okay, so we have a bunch of acronyms out of the way. I gotta tell you, as Lisa took me through the EverLaw certification, I have never seen so many acronyms exist in this process. So if you're a typical Series B enterprise startup, is FedRAMP anything like what they've done before in terms of like running the sales process or a security process? Like, is it like SOC 2? Is it like GDPR?

• 12:10Speaker 02

  I think it depends on what a company has done up until the point they decide, hey, let's do FedRAMP. So if you've been through a SOC 2 Type 2, which is the audit that tests your operational effectiveness, then you're probably in a better position than if you'd only done a SOC 2 Type 1, which is just, do I have a program in place? So I would say it really depends on what the company has done up until then.

• 12:32Steven Sinofsky?

  And what are some of the dimensions to really think about? Like, is it a size of the company thing? Is it, you know, the number of people you have dedicated security? Is it like how much data you store? Like, what are some of the variables that people should be aware of that might impact their time and effort and need and complexity of going through authorization?

• 12:50Speaker 02

  Yeah, it's a great question. The first thing is that if you have a motivated federal agency, that is going to be the biggest factor that either pushes you ahead or slows you down. So if you're in a place where a federal agency has already expressed interest in your product or you've already been in conversations and they're motivated to be your partner in the process and give you the confidence you need to make that financial commitment, because it's going to take internal resources, which has a cost.

• 13:18Steven Sinofsky?

  Like, one of the things that you mentioned was just how the lens of FedRAMP changed the EverLaw culture a little bit to be much more focused on sort of this continuous monitoring sort of mindset. How did that come about?

• 13:31Speaker 02

  From a continuous monitoring standpoint, we found that the FedRAMP controls helped us gel around things like configuration management, making sure there are security checks and security impact analyses. So putting in some of those processes, which on a continuous basis, now we're doing every release, in addition to the things that are just straight up required by continuous monitoring like vuln scanning. I think there is a perception of FedRAMP that it's, you know, a lot of policy, it's a lot of checking the box. And like any team that is staring down the face of a major security compliance and technical project, we were kind of thinking, oh no, there are going to be so many controls in here that are just check the box.

• 14:16Speaker 02

  And like any compliance framework, there certainly is some box checking involved. It's a lot of governance, which is true. There are a lot of control families that deal with a company's infrastructure, like personnel security is the PS control, AT is the awareness training control. But we found that on the whole, a lot of the controls really pushed us forward. And a lot of things we were already doing, there were some things that we needed to improve, but the process has really made our entire infrastructure more secure. No one at Everla had FedRAMP experience before. I mean, we'd been through SOC 2 and we'd been through, we actually undertook it at the same time as GDPR, which looking back is a little bit crazy.

• 14:58Steven Sinofsky?

  We didn't really get a choice in GDPR though, so.

• 15:00Speaker 02

  That's true.

• 15:01Steven Sinofsky?

  So if you're a startup where the team has varying levels of experience and actually haven't gone through all of these things collectively, it sounds like what you're saying is just by virtue of having gone through the process, the whole organization sort of gets upleveled and consistent based on just using this as a framework. You mentioned that it is also deeply technical. Like this is not just a list of, you know, do you have a security policy manual? Do you have cipher locks on your door? There's stuff about the code and the product. What are some of the things that are technical that you had to sort of bring in engineering or product or DevOps and security ops to really think about?

• 15:37Speaker 02

  Yeah, I've already mentioned a few of the other more governance related. Controls before, there's also IR, which is incident response. But some are very technical and just anecdotally, in the system where Everlaw tracks sort of our features and what the things our engineers are working on, there were over 100 tickets in there. I don't know if tickets is the right word, but basically, you know, feature ideas, functionality that we were going to implement, that all required dev resources. And they ranged from simple things like adding a banner into the platform that says, you know, you're entering a federal environment, in our federal environment, to very complicated things.

• 16:15Steven Sinofsky?

  I think one of the things that is kind of interesting, too, is that this is not like a secret part of the government. Like, all the CIOs across all the agencies sort of know this is going on. And so it sounds like it's become their common vocabulary, and security is for the government, the first order of priority before functionality. So their sales team is just going to need to know all of these words, just to interact with the customer.

• 16:37Speaker 02

  Yeah, I presented at our sales kickoff this year, a presentation on selling security, to help them understand, what does it mean to be FedRAMP in process, to make sure that they're not misrepresenting what our status is to the market, but also so that they can talk about it confidently and understand how it's different from our SOC 2 and so forth.

• 16:55Steven Sinofsky?

  So clearly, there's a series of steps that have to happen. Like, what are these steps?

• 17:01Speaker 02

  So that flowchart is actually in the cloud service provider playbook, which we'll provide a link to. And the first step is going to be establishing a partnership with a federal agency. I mean, like we were talking about before, it's just really critical that you have that agency support. And then, once you have that agency support, then you're probably going to feel confident enough to start using your internal resources. So that's going to be putting together the package. And when I say the package, it means system security package, or SSP, which is another acronym. So, working on that documentation, and then also working on any technical remediation you might have to do.

• 17:37Steven Sinofsky?

  And so then eventually, like... Someone who doesn't work for the agency or for Everlaw is going to show up and sort of test you.

• 17:44Speaker 02

  That's right. The step before that authorization is a full security assessment by an independent auditing firm. And in FedRAMP lingo, it's called a three POW. It's a third-party assessing organization. And there's a small set of companies that can do this because they have to meet FedRAMP standards. And so you have to bring them in, just like any other independent auditor, and they review all of-

• 18:07Steven Sinofsky?

  And this is like onsite?

• 18:08Speaker 02

  Yeah, yeah, they came onsite for a week, but they review all of your implementations. I mean, your screenshotting, your working the command line in front of them to show them how you've implemented specific things, so.

• 18:20Steven Sinofsky?

  And do they like snoop around and everybody's like, who are these people in suits? And like, do they have special badges? Like, how does this really work?

• 18:27Speaker 02

  I mean, they're very technical and they're there to make sure that what you've represented in your security documentation is the actual thing you've implemented. I mean, the federal agency is trusting them to help them form their risk-based decisions, so they're serious about it. But they're great, they're nice.

• 18:43Steven Sinofsky?

  And they're basically consultants that come in on behalf of the OMB, basically execute on this plan?

• 18:50Speaker 02

  I mean, they are working for the agency, not for you. You can engage an advisor and-

• 18:54Steven Sinofsky?

  What does that entail?

• 18:55Speaker 02

  So there are other companies that can serve as the independent assessor, or they can serve as a consulting advisor. The key thing, though, is that if you engage a FedRAMP consulting advisor to help you put together your documentation, you can't use them as then the independent assessor. So you've got to swap.

• 19:11Steven Sinofsky?

  Basically, there are these specialists in doing security audits, and there are a list of them that OMB supports, and you can use them either to help you or to audit you.

• 19:23Speaker 02

  Yeah.

• 19:24Steven Sinofsky?

  And you just pick, and you might end up engaging too. But they're basically, it's a consulting engagement.

• 19:28Speaker 02

  That's right. And you might be thinking, why would I want to engage a consultant?

• 19:31Steven Sinofsky?

  To help you with a consultant.

• 19:32Speaker 02

  Yeah, exactly. But the fact is, even with all of the program documentation that we had at Everlaw, you know, the whole suite of InfoSec policies, we had great procedures around personnel security and training, but we still needed to engage a consulting advisor to help us put together the system security package. It's, of course, a template that you can pull down from federamp.gov. And since we're an AWS customer and we inherit a lot of the cloud infrastructure controls from AWS, AWS will also provide you with that as well. But it's some things-

• 20:04Speaker 02

  Are just hard to navigate without the experience of knowing what the agency will accept. So a couple of examples are the consulting advisor can help you translate what the agency's actually looking for when it comes to an implementation. So if you have to do a deviation from a CIS benchmark.

• 20:21Steven Sinofsky?

  Ultimately, this process boils down to creating a lot of documentation. Like, they don't just have a phone call and take your word for it. So a lot of it sounds, I mean, like you said, like, oh, well, you inherit some of it from AWS. So it sounds like sort of this large amount of paper that has a bunch of forms that are all filled in already.

• 20:37Speaker 02

  Well, our full SSP without the attachments with the implementations described is around 500 pages. But the template itself, even without those, is probably, I don't know, it's probably 30 pages or 40 pages, just without all our info in it. It's a big lift to do that. So we found that a consulting advisor could, we could spend some time talking with them, chatting with them on the phone, explaining things, and then they would go write it up for us, and then we would QA it. So instead of us having to do that big lift, they did that for us, and then it was much more efficient that way.

• 21:10Steven Sinofsky?

  So, you know, obviously, there's a bunch of sections and chapters and different parts. Which part of it was the part that really was like a ton of work? Where like, the engineers needed to engage, and you needed really detailed technical answers? Like, what was the scope of that and where in the process?

• 21:24Speaker 02

  So, we went back and forth with our consulting advisor. So we would describe our technical implementations, and then they would take the first crack at writing them up. And then our director of infrastructure had to edit things out, because every once in a while, but also describing our entire system architecture and doing the architecture diagrams. Those are all things that, you know, our engineering team definitely had a hand in.

• 21:48Steven Sinofsky?

  Right. And it turns out, it's one of those things that like, well, we didn't really have a good architecture diagram of our system. And so now we have one, and now we keep it up to date, because we have to, because of CONMON and all that. But sort of ended up being beneficial, anyway. Okay, so.

• 22:03Steven Sinofsky?

  You've got like this 500-page SSP thing sort of all bound up and ready to go. How do you know you're getting to the finishing line? And what does that start to look like?

• 22:12Speaker 02

  So, once we had all of the documentation wrapped up and, you know, you can't get too hung up on, you know, the final product because the whole thing is meant to be a living document because, you know, when we finished documenting it, then we knew we were going to implement something else. So it's sort of, you know, you're going to have to keep updating it. But the finish line comes when you're ready to actually hand that package over to the independent auditor and to say, all right, you know, here is all our stuff. We're putting it out there for you to review and schedule that onsite audit.

• 22:40Steven Sinofsky?

  And so then the auditors show up, they read a lot, they watch you doing the work. And then what happens?

• 22:47Speaker 02

  Then they put together what's called a SAR, which means Security Assessment Report. The SAR is the auditor's report on your overarching compliance with the baseline. And if they have findings, they'll rank them as, you know, high, medium, or low.

• 23:04Steven Sinofsky?

  Like concern?

• 23:05Speaker 02

  Yeah, exactly. Because what their job is, is to describe to the agency what the risks are to using the system. So if they find things during the audit that they deem as a high risk and, you know, it's all scoped out what those risk categories are, but they'll deliver that to the agency.

• 23:22Steven Sinofsky?

  And again, to your point about risk, it's not like a pass/fail because then the agency, who's the customer, looks and says, ooh, you have two highs, that might be two too many. Or are you planning on fixing this? If you're planning on it, that's good. There's like a whole give or take. After you do 18 months' worth of work or nine months' worth of work, you don't fail and have to go back. And the customer is in control of evaluating the risk of like still buying you or not.

• 23:48Speaker 02

  Yeah, and those findings would go on to what's called a POAM or Plan of Action and Milestones. So, once you have those findings, then you would describe what you're going to do to fix it, what's your timeline, what are your milestones, and so forth. And one of the benefits of having that consulting advisor looking at your package and helping you do that is they'll tell you what a showstopper is. They'll say, hey, that implementation's not going to cut it. Don't do that. Let us help you.

• 24:13Steven Sinofsky?

  So, sometimes people think about compliance, they think about it as sort of like getting your driver's license. Like you get annoyed, you go through a process, you take a test, and then poof, you have a driver's license basically for the rest of your life. But FedRAMP isn't really like that. There's a lot about monitoring and keeping things. And so what did you learn going through the process that was different than other types of certification or authorization?

• 24:34Speaker 02

  I mean, the one thing I've learned is that FedRAMP is not over. And I have to laugh.

• 24:39Steven Sinofsky?

  OK, that's like an uplifting emotion. Like, yeah, please listen to our podcast for the thing that's never going to end.

• 24:44Speaker 02

  Well, it's just funny because we've been working on this. And every time we hit a big milestone, we like to celebrate it with the wider team. And everybody's like, yay. And then they're like, oh, you're done with FedRAMP now, right? And we're like, no. So, you know, continuous monitoring is one thing we already mentioned where even once you obtain your authority to operate or your ATO, and you have that authorization, you're still going to be working with the agency on a regular basis.

• 25:09Steven Sinofsky?

  So you have your ATO, and you've got a bunch of Kanban going on, just to use all the acronyms in one sentence.

• 25:14Speaker 02

  Yeah, and we'll link to the Kanban guide, which talks about what that looks like. But in a nutshell, you're doing monthly scanning, you're ranking vulnerabilities, you're responding to those on a specified time basis, et cetera.

• 25:29Steven Sinofsky?

  So let's say that the company is ready to dive in. They have a product that they've been selling to commercial customers. The first cohorts believe it meets their needs for security and privacy and things like that. The product is selling. But now if agency is interested, for whatever reason, they're inbound, or you spoke at a conference or something. So first, how long do the salespeople have to wait until a deal is closed now?

• 25:52Speaker 02

  Well.

• 25:53Steven Sinofsky?

  Oh, be nice.

• 25:54Speaker 02

  Yeah, I mean, again, it depends on how motivated the agency is.

• 25:58Steven Sinofsky?

  So actually, that's a super important point. It's not just how motivated you are as the company. Like, if the agency really wants you, they can pull you through in a lot of ways.

• 26:06Speaker 02

  Yeah, because, again, it's all about risk. And, you know, the agency is the decider of what kind of risk they're going to tolerate. And so if an agency is really motivated, then they can help push you along to becoming in-process. And in-process is a designation that requires explicit agency support. But if you're at that stage where you've got that interest, you have to choose, OK, am I going to go? There are two ways to get authorized. There's the agency route, and then there's something called the JAB, which is the Joint Authorization Board, which is a little bit harder to do because you have to do a business case. So I think for our purposes, it makes more sense to address the agency route, which is probably the situation you're talking about. Where somebody expresses interest.

• 26:49Steven Sinofsky?

  Right, so that's probably a good lesson for folks, which is that the best bet for going through this is, in a sense, to first line up a potential customer, rather than just sort of say, oh, well, let's preemptively go and do FedRAMP, because it actually makes more work for yourself if you don't have the first customer lined up.

• 27:03Speaker 02

  Yeah, that's right. And they do have that job process, which is for companies that might have a broad application, but it's a much different process.

• 27:12Steven Sinofsky?

  Okay, so there's a bunch of, like, actual bureaucracy stuff about getting on the GSA list and filling out those forms. But then, like, is it a year, two years, five years? How long is this exactly?

• 27:24Speaker 02

  Yeah, let's not keep the sales team hanging too long. So if you're counting from the time you have your package already, it could be as little as a few months, maybe even six weeks, we've heard, for the agency to review that package and grant you the authorization. I think if you're counting from the day the team says, hey, let's do FedRAMP, and you still have to put the package together, you're probably looking at at least, you know, nine months.

• 27:47Steven Sinofsky?

  Right.

• 27:48Speaker 02

  Or a year, possibly.

• 27:49Steven Sinofsky?

  So it's actually not wildly out of bounds with what a procurement team might do, or like, any of the large tech companies that just do what they call a security audit or something, might easily take that same length of time.

• 27:59Speaker 02

  It comes down to how many resources the company has to bring to bear on the project. Because, you know, we took a little bit longer, but that's because we didn't stop people from doing their full-time jobs, only to work on FedRAMP. We didn't stop feature development for the product.

• 28:14Steven Sinofsky?

  So you decided you're, like, flipping the switch and you're gonna go for it. Did you have a team of 10? Like, how many people have to do all of this checkboxing and process documentation and Kanban stuff?

• 28:26Speaker 02

  So when we started, it was just myself on the security team. We had our engineers that were involved in sort of scoping and looking at how much work we thought it would be. And then, over time, we brought on a DevOps person, we hired a couple of people onto my team. But again, none of us have been doing it full-time. So it's been probably a core group of five people, working on various elements of it. And then, when we were doing the push to complete a lot of the technical and engineering work, we brought in other engineers.

• 28:57Steven Sinofsky?

  And this is an interesting point, because of the way you chose to do it, but you overlaid Like SOC 2 and GDPR and other privacy work, sort of all at the same time, which sounds overwhelming, but it's all so closely related. Was it more efficient to do it that way?

• 29:11Speaker 02

  Doing a lot of these broader things like GDPR and FedRAMP, you know, there is overlap, so it certainly helps. I don't know that I would wish all those things on anyone, but certainly you're doing a lot of the same things. And, you know, for folks that do SOC 2, you probably know the COSO standards were added, I think, last year.

• 29:31Steven Sinofsky?

  OK, so one last thing, which is, you go through all of this. You're given the label like in process, authorized, like what is the specifics of that? Because that's something that salespeople often do get confused because of the FedRAMP lingo, so to speak.

• 29:45Speaker 02

  The lingo can be slightly confusing. So in order to be listed in the FedRAMP marketplace on the website.

• 29:51Steven Sinofsky?

  A marketplace which is literally like, these are the cloud things you can go buy as a federal agency.

• 29:56Speaker 02

  Yeah, exactly. So there's FedRAMP ready and FedRAMP in process. And I think people swap those around a lot. So FedRAMP ready means that you've gone through sort of a high level evaluation. And if you get that ready stamp, it means that they think that you're capable to meet the FedRAMP requirements. And it's just intended to help agencies look out there and say, oh, well, you know, there's an independent assessment that these folks are ready and can probably do it. Whereas in process is a designation where you have to have the authorizing official at an agency tell the FedRAMP office that we are working with this cloud service provider on an authorization. You're not authorized yet, but you're affirmatively working on that authorization.

• 30:41Steven Sinofsky?

  And don't play fast and loose with those terms with your salespeople. Like, don't make up what they mean and don't say what you aren't. Because they have like branding guidelines and stuff.

• 30:50Speaker 02

  Yeah, the FedRAMP office has branding guidelines. And, you know, for a good reason. They don't want companies out there saying that, you know, they have a FedRAMP authorization. If they don't, they've worked hard on creating this process and creating this framework. And they don't want companies misrepresenting.

• 31:06Steven Sinofsky?

  And so ultimately with security things, the reason, you know, nobody wants anything to happen, like a breach or anything like that. But if you're operating in this environment where you've committed to a customer, in this case, a federal agency, that you do all this stuff, and then something happens, does

• 31:22Steven Sinofsky?

  FedRAMP have say in, like, are they part of like adjudicating the failure? Or do they have remediation duties like, or is they're not involved in that? Like, where does the government come in in terms of a security issue?

• 31:34Speaker 02

  Well, fortunately, I don't have direct experience with that. But the CONMON guide on continuous monitoring does cover various types of escalations, like incidents. And so I think if a company had an authorization and they had some kind of security incident or breach occur, it would go through that escalation process in the CONMON. And certainly, they contemplate revocation of your authorization. But I imagine it would be a conversation with the folks at the agency, you know, talking about your plan for remediation. Did you catch it? Did you limit the damage? So I don't have sort of a black and white answer on what would happen there. But I know that they've put a framework in place to address those kinds of things.

• 32:16Steven Sinofsky?

  All right. So in your role in Everlaw, you've gone through quite a few certifications, like you've gone through GDPR, you've gone through SOC 2, you're working on Fed-- like, where does this fall in the spectrum of effort and time and complexity compared to-- you've done some healthcare, even though HIPAA is not a certification.

• 32:34Speaker 02

  Yeah, we've done the privacy SOC 2, but we've also done an independent sort of HIPAA compliance assessment as well. And FedRAMP has definitely been the most work because it involves, you know, from an architectural standpoint, you know, we're creating a federal environment and there's a lot of work that we've done to improve on the back end. But I'm trying to think, because GDPR is also a ton of work.

• 32:58Steven Sinofsky?

  It's actually a good time to mention, too. One of the things that I found particularly interesting as I dove into this with you is that at every step, the OMB has really worked to make this like attractive and easy. That sounds weird, but their goal is not to stop you from getting authorized. It's actually to find ways to get you authorized.

• 33:17Speaker 02

  And for what it's worth, the FedRAMP.gov website is one of the best federal websites out there. They have a person who's the customer success manager. So they really are trying to make it easier for cloud companies to go through this process to understand. And Everlaw, we met with those folks and they helped us. They helped guide us. And so we found that to be really helpful.

• 33:38Steven Sinofsky?

  Yeah. So unlike what you'd normally think of in terms of regulation or certification, they don't come across as like, we're here to prevent you from getting this.

• 33:46Speaker 02

  No, not at all.

• 33:47Steven Sinofsky?

  It's not even like the DMV in that regard. They actually just want to help you.

• 33:50Speaker 02

  Yeah. I mean, their mandate is to help carry out the cloud first or the policy that the government has to push IT modernization and cloud adoption in the federal government.

• 34:01Steven Sinofsky?

  Well, this was super fun. So thanks so much. This has been Stephen Sonoski and...

• 34:05Speaker 02

  Lisa Hawk. Thank you.

• 34:07Steven Sinofsky?

  Thank you very much.